Conflict with graylogs data in Elasticsearch.

[007anwar]

I have Spring boot services that are sending its logs to graylog's and stored in elasticsearch, now when I am trying to add zipkin feature to my existing services I am able to see traces on zipkin but as soon as zipkin's index is created in Elasticsearch the graylog's data is getting corrupted.

[PheaSoy]

I am also using the same scenario - but no issue like this. Which zipkin version and the configuration you set?

[007anwar]

I am using openzipkin/zipkin:2 with following configuration

• STORAGE_TYPE=elasticsearch
• ES_HOSTS=http://172.18.0.10:9200 ports
• 9411:9411

[PheaSoy]

By default zipkin will create an index with pattern zipkin-span-yyyy-mm-dd. So it should not be impact to your graylog index if this is separate index. If you are using ES 7.0.x you can restrict the permission access for user from zipkin too.

[007anwar]

When I use Graylogs and zipkin both together and as soon as zipkins index is created I get following error on dashboard of graylogs and all logs go away

While retrieving data for this widget, the following error(s) occurred:
Unable to perform search query: failed to create query: { "bool" : { "must" : [ { "bool" : { "filter" : [ { "match_all" : { "boost" : 1.0 } }, { "match_all" : { "boost" : 1.0 } } ], "adjust_pure_negative" : true, "boost" : 1.0 } }, { "range" : { "timestamp" : { "from" : "2020-06-25 11:48:48.443", "to" : "2020-06-25 11:53:48.443", "include_lower" : true, "include_upper" : true, "boost" : 1.0 } } }, { "terms" : { "streams" : [ "000000000000000000000001" ], "boost" : 1.0 } } ], "adjust_pure_negative" : true, "boost" : 1.0 } }.

but when I manually recalculate index rage all error go away and I see logs back.

[007anwar]

anybody here to resolve this.......

[codefromthecrypt]

maybe ask someone at graylogs? We neither control elasticsearch nor clones of it and which APIs act differently. especially we never claimed to support graylogs and certainly dont test with it.

you can include http output with ES_HTTP_LOGGING which might help them figure out what is misunderstood.

https://github.com/openzipkin/zipkin/tree/master/zipkin-server#elasticsearch-storage

On Fri, Jun 26, 2020, 5:58 PM 007anwar notifications@github.com wrote:

anybody here to resolve this.......

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub https://github.com/openzipkin/zipkin-support/issues/21#issuecomment-650096553, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAAPVV4H42TBYUFEK7P2XMDRYRWNXANCNFSM4OGEDZLA .

[007anwar]

This issue is resolved after providing volume to mongoDb along with elasticsearch

[codefromthecrypt]

thanks for responding back to the thread!